📦

cold-offer

Name: cold-offer
Author: cmj-hub

Inhaltsrevision r1 Hohes Risiko 🌐 Netzwerkzugriff⚙️ Externe Befehle📁 Dateisystemzugriff🔑 Umgebungsvariablen⚡ Enthält Skripte

Draft Cold Offers Around Concrete Findings

Cold outreach often asks for a purchase before showing useful work. This skill structures a finding, a small solution sample, and a first email with local draft checks.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Maintain this Skill? Claim it ⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "cold-offer" from https://skillstore.io/skills/cmj-hub-cold-offer.md and its manifest at https://skillstore.io/api/skills/cmj-hub-cold-offer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/cmj-hub-cold-offer.md Signiertes manifest GET /api/skills/cmj-hub-cold-offer/manifest Signiertes lockfile GET /api/skills/cmj-hub-cold-offer/lockfile

Testen

„cold-offer“ wird verwendet. Draft an offer about a homepage requesting meetings before showing any work.

Erwartetes Ergebnis:

Finding: Your homepage asks for a meeting before showing a work sample.
Prototype: A one-page sample that presents the finding and a short trial first.
First email: Your homepage asks for a meeting before showing any work. I prepared a one-page alternative. May I share the full report?

„cold-offer“ wird verwendet. Check a complete draft whose first email says: Buy our retainer.

Erwartetes Ergebnis:

Result: Rejected because the first email contains a configured paid-product pitch phrase.
Revision: Share the specific finding and the prepared sample instead of asking for a purchase.

„cold-offer“ wird verwendet. Check a draft with a finding and first email but no prototype.

Erwartetes Ergebnis:

Result: Draft is incomplete.
Revision: Add a nonempty prototype description before checking again.

Sicherheitsaudit

Hohes Risiko

v1 • 3.10.2026 Versionsbericht öffnen

Most static findings are harmless documentation, CSS, encoding markers, or legitimate local tooling. Confirmed risks affect optional asset renderers: unsafe HTML insertion, inline script serialization, CSS interpolation, and unconditional frame directory deletion. No evidence found of prompt injection, credential theft, or malicious exfiltration; the Python scorer performs local validation without network access.

Gescannte Dateien

701

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch

assets/demo.mjs:13-14 assets/demo.mjs:67-68

Inline Script Breakout Through Specification Data

The demo renderer embeds JSON.stringify output directly in a script element. Supplied strings containing a closing script tag can terminate it and inject executable markup.

JSON.stringify does not escape HTML script terminators. The browser parses these serialized values inside an executable script element before DOM insertion.

Hoch

assets/card.mjs:17 assets/card.mjs:25-37 assets/demo.mjs:12 assets/demo.mjs:17-25

Unchecked Color Value Can Escape Style Elements

Both renderers interpolate supplied accent_color values directly into style elements. A crafted value can close the style element and introduce scripts or external resources.

Neither renderer validates accent_color before HTML interpolation. Text escaping elsewhere does not protect this separate style-element context.

Elemente der Fähigkeitsprüfung (3)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

assets/demo.mjs:90

innerHTML assignment (XSS risk)

document.getElementById('lines').innerHTML = h;

Response lines from the supplied specification are concatenated into HTML without escaping. Malicious markup can execute browser event handlers during rendering.

Hoch

assets/demo.mjs:91

innerHTML assignment (XSS risk)

document.getElementById('artwrap').innerHTML = (ART && t>=T_ART)

Artifact labels and lines from the specification are inserted as unescaped HTML. Crafted tags can execute browser scripts or initiate unwanted requests.

Mittel

assets/demo.mjs:4

Synchronous file operations

import { readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

The imported rmSync recursively deletes the output-derived frames directory at lines 102 and 119. Existing contents are removed without an ownership check.

Risikofaktoren

🌐 Netzwerkzugriff (6)

.claude-plugin/plugin.json:9 assets/card.mjs:22 assets/card.mjs:23 assets/card.mjs:24 assets/demo.mjs:16 CONTRIBUTING.md:32

⚙️ Externe Befehle (18)

assets/card.mjs:4 assets/card.mjs:97 assets/card.mjs:21-65 assets/card.mjs:65-66 assets/card.mjs:66-87 assets/card.mjs:95 assets/card.mjs:99 assets/card.mjs:101 assets/card.mjs:107 assets/demo.mjs:5 assets/demo.mjs:116 assets/demo.mjs:15-97 SKILL.md:33 SKILL.md:41-44 SKILL.md:44-48 SKILL.md:48 SKILL.md:54-60 tests/test_score.py:14

📁 Dateisystemzugriff (7)

assets/card.mjs:3 assets/card.mjs:92 assets/card.mjs:96 assets/demo.mjs:4 assets/demo.mjs:100 assets/demo.mjs:103 assets/demo.mjs:39

🔑 Umgebungsvariablen (2)

assets/card.mjs:7 assets/card.mjs:7

⚡ Enthält Skripte (2)

assets/demo.mjs:90 assets/demo.mjs:91

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/cmj-hub-cold-offer/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/cmj-hub-cold-offer/security.svg)](https://skillstore.io/skills/cmj-hub-cold-offer?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/cmj-hub-cold-offer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cmj-hub-cold-offer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/cmj-hub-cold-offer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

cmj-hub. (2026). cold-offer security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cmj-hub-cold-offer/audits/1

BibTeX-Zitat

@techreport{cmj-hub-cmj-hub-cold-offer-2026,
  author = {cmj-hub},
  title = {cold-offer security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cmj-hub-cold-offer/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cold-offer security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cmj-hub"
date-released: "2026-10-03"
url: "https://skillstore.io/skills/cmj-hub-cold-offer/audits/1"
identifiers:
  - type: other
    value: "skillstore:cmj-hub-cold-offer:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Founder Outreach

Draft a first email that shares a specific public-page observation and a small sample instead of requesting a demo.

Consulting Offer Preparation

Package a verified business finding with a limited solution sample before discussing a larger paid engagement.

Team Draft Review

Check draft completeness and configured pitch phrases before a human reviews the message for sending.

Diese Prompts ausprobieren

Draft a First Offer

Draft a cold offer from this verified observation: [finding]. Include a finding, a small solution sample, and a first email without a product pitch.

Rewrite a Pitch

Rewrite this email: [draft]. Lead with [verified finding], name [prepared sample], and remove purchase requests, meeting requests, and demo invitations.

Validate a Draft

Review my draft at [local path]. Use the local scorer to check required fields and pitch phrases, then suggest revisions without sending anything.

Prepare and Review Variants

Create three offer variants from [verified finding] and [prepared sample]. Compare clarity, validate each locally, and explain limitations of the phrase checks.

Bewährte Praktiken

Use verified public observations and describe only samples you have actually prepared.
Review scorer results manually because fixed phrase checks can reject harmless text or miss sales pitches.
Keep the core drafting workflow separate from optional asset renderers until their security issues are fixed.

Vermeiden

Inventing recipient problems or claiming unfinished work is already available.
Treating a successful scorer result as proof of accuracy, compliance, or effective outreach.
Passing untrusted specifications to the optional renderers or reusing directories containing important files.